redline | a9db37183a4d7898d4ef820075d9fb5cdef55b47644cc5465b5e012c9a52b2fe | Triage

Resubmissions

08-07-2021 11:17

210708-5s29gx8mxn 10

08-07-2021 11:17

210708-lndt9d354a 10

Analysis

max time kernel
1789s
max time network
1806s
platform
windows7_x64
resource
win7v20210408
submitted
08-07-2021 11:17

Sharing

Report Analysis Logs

General

Target

0x00030000000130e1-156.exe
Size

380KB
MD5

b0486bfc2e579b49b0cacee12c52469c
SHA1

ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA256

9057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512

b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075

Score

10^/10

redline servani infostealer

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral11/memory/1152-62-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral11/memory/1152-63-0x0000000000417F26-mapping.dmp	family_redline
behavioral11/memory/1152-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

0x00030000000130e1-156.exe

description pid process target process

PID 1016 set thread context of 1152 1016 0x00030000000130e1-156.exe 0x00030000000130e1-156.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0x00030000000130e1-156.exe

description pid process

Token: SeDebugPrivilege 1152 0x00030000000130e1-156.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0x00030000000130e1-156.exe

description	pid	process	target process
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 1016 wrote to memory of 1152	1016	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe

C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
"C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-60-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/1152-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1152-63-0x0000000000417F26-mapping.dmp

Download
memory/1152-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1152-66-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download